Procurement Integrity and Responsible Stewardship

Status, question and scope

Research question

Which controls make procurement a source of confidence rather than institutional risk?

Scope

Procurement connects authority, competition, records, conflicts, performance and public resources. Weakness in any element can undermine both delivery and legitimacy.

ASPC application and limitations

Proposed application

• Publish decision authority, evaluation criteria, conflict procedures and permitted exceptions.
• Link identified risks to named mitigations, owners, deadlines and residual-risk decisions.
• Track delivery, changes, acceptance, payment and closeout in one auditable record.

Limitations

• This note is a governance synthesis, not procurement law or legal advice.

Documented findings

Controls must follow identified risk

GAO-15-377 found that fiduciary risk assessments for reviewed government-to-government assistance were generally completed when required, but timing and follow-through weakened their value. Assessments sometimes came after project planning, risk-mitigation actions were not always incorporated into implementation records, and late audits delayed corrective follow-up.

GAO's Standards for Internal Control in the Federal Government organizes internal control through five components: control environment, risk assessment, control activities, information and communication, and monitoring. The Green Book stresses that management designs controls in response to objectives and risks and evaluates whether they operate as intended.

Procurement implication

Competition rules alone do not establish integrity. A defensible system also preserves requirements, market analysis, evaluation criteria, conflicts, approvals, contract changes, acceptance evidence, payments, assets and corrective actions.

Control notes

Minimum procurement file

• Approved need, scope, budget, method and responsible official.
• Market evidence and a documented basis for competition or exception.
• Conflict declarations, evaluation record and approval trail.
• Signed terms, deliverables, milestones, ownership and change controls.
• Inspection or acceptance evidence matched to invoices and payments.
• Complaint, audit, asset and closeout records retained under policy.

Risk-based oversight

Higher-value, novel, urgent or concentrated procurements require enhanced review. Red flags include repeated single-source awards, specifications tailored to one supplier, split purchases, unexplained scoring changes, weak segregation of duties and payment before verified acceptance.

ASPC should document exceptions and monitor whether mitigating controls actually operate. Absence of a detected violation is not proof that the control environment is effective.